APK operation compliance verification method and system based on cloud policy control

Abstract

The invention discloses an APK operation compliance verification method and system based on cloud policy control. A client verification module is embedded in an application, environment feature information representing a running environment is collected in the starting and running stages of the application, and the information is encrypted and sent to a cloud verification service; the cloud verification service performs matching analysis on the operation environment based on a pre-configured strategy rule to generate a corresponding verification control instruction; and the client verification module performs runtime control on the display process or process state of the application according to the verification control instruction. The verification logic and the strategy rule are intensively maintained by the cloud and can be dynamically updated, and the client only executes the cloud instruction, so that the effective verification of the compliance use of the APK is realized, and the application is prevented from being used in an unauthorized operation environment.

Description

Technical Field

[0001] This invention relates to the fields of mobile application security and software copyright protection, and in particular to a method and system for APK execution compliance verification based on cloud-based policy control. Background Technology

[0002] In the development and delivery of mobile applications, software source code is typically provided to customers through licensing agreements. However, in real-world business environments, once delivered, source code often faces the risk of being recompiled, repackaged, and used in unauthorized scenarios. Especially in situations involving multiple projects, multiple devices, and multiple customers deployed in parallel, the original developer struggles to effectively differentiate and control the actual runtime environment of APKs generated from the same source code, leading to the unauthorized use of the source code by third-party solution companies or unauthorized entities.

[0003] In existing technologies, to prevent the misuse of source code, APKs are typically protected using methods such as code obfuscation, static encryption, and signature verification. However, most of these solutions rely on local implementation on the client side, and their verification logic and control mechanisms are distributed along with the APK. This makes them vulnerable to removal or bypass after decompilation, repackaging, or modification of the runtime environment, hindering their ability to continuously exert constraints during application runtime. Furthermore, these solutions are mostly static verification methods, unable to be dynamically adjusted based on different project identifiers, device models, or usage scenarios, lacking flexibility and scalability.

[0004] On the other hand, although some existing solutions have introduced network verification mechanisms, their verification results are often only used for prompts or records, lacking the ability to substantially control the application's running process or process status. They cannot promptly block the application from continuing to run when an abnormal running environment is detected, thus making it difficult to form an effective technical constraint on unauthorized use.

[0005] Therefore, how to separate the verification logic and control strategy from the APK without significantly increasing the burden on the client, and how to achieve dynamic judgment and process-level control based on cloud policies during the application runtime phase, has become a technical problem that urgently needs to be solved in the compliant use and protection of mobile application source code.

[0006] Therefore, existing technologies still need to be improved. Summary of the Invention

[0007] Existing protection solutions for APK source code compliance still primarily rely on client-side local verification or static protection methods. Verification logic is distributed along with the application, making it easily bypassable, and lacks the ability to dynamically identify and effectively control different runtime environments during application operation. Especially in actual authorized use scenarios, it is difficult to respond promptly to unauthorized runtime environments and substantially constrain the application's runtime state, resulting in a lack of reliable and sustainable technical guarantees for source code compliance. Therefore, it is necessary to provide a new technical solution to overcome these shortcomings.

[0008] The technical solution of the present invention is as follows: This invention provides a cloud-based policy control-based APK execution compliance verification method, comprising the following steps: S1. During the application startup phase running on the mobile terminal, the client verification module embedded in the application collects environmental feature information that characterizes the current application running environment. S2. The environmental feature information is encrypted and encapsulated before being sent to the cloud verification service; S3. The cloud-based verification service performs matching and analysis on the environmental feature information based on pre-configured policy rules, and generates verification control instructions corresponding to the current operating environment. S4. The client verification module receives the verification control instruction and controls the display flow or process status of the application during application operation according to the verification control instruction, so as to realize runtime verification of APK compliance.

[0009] In one embodiment, the environmental characteristic information includes at least one or more of the following: application identification information, application version information, terminal device model information, terminal device unique identification information, and project identification information.

[0010] In one embodiment, the environmental feature information is encrypted and accompanied by integrity verification information before being sent to the cloud verification service to prevent the operating environment information from being tampered with during transmission.

[0011] In one embodiment, the policy rules include at least a whitelist policy for allowing the application to run normally, a blacklist policy for restricting the application from running, and a default policy for unknown operating environments.

[0012] In one embodiment, the verification control instruction includes at least a control identifier for whether to trigger a user interaction prompt, the content of the prompt message, and control parameters for whether to terminate the application process.

[0013] In one embodiment, when the verification control instruction indicates the termination of the application process, the client verification module, after completing user interaction or meeting preset conditions, calls the system-level process control interface to terminate the current application process.

[0014] In one embodiment, the policy rules and verification logic are centrally maintained and dynamically updated by the cloud verification service. The client verification module does not contain decision logic for judging compliance, but only performs corresponding operation control operations based on the verification control instructions returned by the cloud.

[0015] Another aspect of the present invention provides an APK execution compliance verification system based on cloud-based policy control, characterized in that it includes: The client-side verification module is used to collect environmental characteristic information of the application's operating environment and control the application's running status based on the verification control instructions returned from the cloud. The cloud-based verification service module is used to receive the environmental feature information and generate the verification control instructions based on policy rules.

[0016] In one embodiment, the cloud verification service module includes a policy management unit for configuring, updating, or distributing policy rules.

[0017] In another aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is used to implement the method described in any of the preceding claims.

[0018] In summary, this invention centrally deploys the APK compliance verification logic and control strategies in the cloud, while retaining only runtime environment information collection and verification command execution functions on the client side. This eliminates the reliance on local logic distributed with the APK for application compliance judgment, thus reducing the possibility of verification mechanisms being tampered with or bypassed from a technical architecture perspective. Furthermore, by introducing a cloud-based dynamic verification and control mechanism during application runtime, the system can flexibly adjust verification results based on different project identifiers, terminal devices, or runtime environments, and effectively control the application's display flow or process status when necessary.

[0019] Under the above technical solution, the client-side implementation remains lightweight, without affecting the normal functionality and performance of the original application. Meanwhile, the cloud-based policies can be continuously maintained and updated according to actual authorization scenarios, thus achieving continuous constraints on the compliant use of APKs without increasing the complexity of source code delivery. This solution can adapt to real-world application environments with multiple projects, multiple terminals, and multiple authorized entities, providing a stable, controllable, and practically feasible technical means for the compliant use of mobile application source code.

[0020] Compared to existing technical solutions that primarily rely on local client-side verification or static protection methods, this invention centrally deploys the compliance verification judgment logic and control strategies in the cloud, and executes only the verification control instructions issued by the cloud on the client side. This eliminates the need for APK compliance control to depend on the local judgment logic distributed with the application. This architectural change allows the verification mechanism to continue to exert its binding effect during runtime even if the application is decompiled, repackaged, or its runtime environment is tampered with—an effect that is difficult to achieve with traditional client-side protection solutions.

[0021] Furthermore, this invention does not merely identify or prompt the operating environment; instead, it dynamically generates executable control commands through cloud-based strategies and controls the application's display flow or process status during client operation. This allows the system to take timely restrictive measures when abnormal operating environments are detected. Compared to existing solutions that only provide log recordings or prompts, this approach technically achieves substantial intervention in unauthorized use, significantly improving the effectiveness of source code compliance control.

[0022] Furthermore, since the policy rules are centrally maintained in the cloud and can be flexibly configured according to different projects, terminal devices, or authorized scenarios, this invention achieves unified management and differentiated control of multiple projects and multiple terminal environments without increasing the complexity of client implementation. This asymmetric verification mode of "lightweight client and policy-based cloud" gives the system good scalability and maintainability in engineering implementation, and its overall technical effect is not a simple superposition of existing static verification schemes or single network verification schemes.

[0023] In summary, this invention improves the reliability of APK compliance control while taking into account engineering feasibility and operational performance. It can continuously play a technical constraint role in actual authorized use scenarios, achieving comprehensive technical effects that exceed the expectations of existing technologies. Attached Figure Description

[0024] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings: Figure 1 A flowchart illustrating the method steps of an APK execution compliance verification method based on cloud-based policy control provided by this invention; Figure 2 A flowchart of step S1 of an APK execution compliance verification method based on cloud policy control provided by the present invention; Figure 3 The flowcharts for steps S2 and S3 of the APK execution compliance verification method based on cloud policy control provided by the present invention are shown below. Figure 4A flowchart of step S4 of the APK execution compliance verification method based on cloud policy control provided by the present invention; Figure 5 The overall flowchart of an APK execution compliance verification method based on cloud policy control provided by the present invention; Figure 6 This invention provides a system architecture block diagram for an APK execution compliance verification system based on cloud-based policy control. Detailed Implementation

[0025] To make the objectives, technical solutions, and effects of this invention clearer and more explicit, the invention is further described in detail below. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. The embodiments of the invention are described below in conjunction with the accompanying drawings.

[0026] One embodiment of this invention provides a cloud-based policy control-based APK execution compliance verification method. Please refer to [link to relevant documentation]. Figures 1-5 It includes the following steps: S1. During the application startup phase running on the mobile terminal, the client verification module embedded in the application collects environmental feature information that characterizes the current application running environment. This embodiment provides a cloud-based policy control-based APK runtime compliance verification method, which is applicable to application scenarios that perform compliance verification and control on APKs generated from delivered source code during actual runtime.

[0027] During the application startup phase, the licensor pre-embeds a client-side verification module in the APK source code. This client-side verification module can be integrated into the application project as a standalone SDK component and is triggered at the application's startup entry point. When the application is loaded and running, the client-side verification module automatically enters the initialization state to perceive and collect information about the current application's runtime environment.

[0028] After initialization, the client-side verification module collects environmental characteristic information to characterize the current application's operating environment. This environmental characteristic information may include the application's own identification information, such as the application package name and version number, as well as terminal device-related information, such as device model, unique device identifier, and project identifier information used to distinguish different authorized projects. The collection of this environmental characteristic information is completed silently on the client side, without affecting the normal execution of the application's original functions.

[0029] Furthermore, the method also includes: S2. The environmental feature information is encrypted and encapsulated before being sent to the cloud verification service; After collecting environmental feature information, the client verification module encapsulates the collected information. Specifically, the environmental feature information is organized according to a predetermined data structure, and the encapsulated data is encrypted and its integrity verified to prevent unauthorized tampering during transmission. Subsequently, the client verification module sends the encrypted environmental feature information to the cloud verification service via network communication.

[0030] Furthermore, the method also includes: S3. The cloud-based verification service performs matching and analysis on the environmental feature information based on pre-configured policy rules, and generates verification control instructions corresponding to the current operating environment. After receiving environmental feature information from the client, the cloud-based verification service parses the information and performs matching analysis based on pre-configured policy rules. These policy rules can be configured according to different authorized projects, terminal device types, or usage scenarios to determine whether the current application's operating environment meets the expected compliance requirements. After completing the matching analysis, the cloud-based verification service generates a verification control command corresponding to the current operating environment and returns the verification control command to the client's verification module.

[0031] Furthermore, the method also includes: S4. The client verification module receives the verification control instruction and controls the display flow or process status of the application during application operation according to the verification control instruction, so as to realize runtime verification of APK compliance.

[0032] After receiving the verification control command returned from the cloud, the client verification module parses the command and performs corresponding control operations during application operation. When the verification control command indicates that the application can run normally, the client verification module does not interfere with the application's display flow or running status; when the verification control command indicates that restrictions are needed, the client verification module can trigger corresponding control flows during application operation to intercept the application's display flow, or control the application process status after preset conditions are met.

[0033] Through the above steps, this implementation method achieves APK runtime compliance verification based on cloud policies without relying on local client-side judgment logic. This enables applications to dynamically accept cloud verification and control during runtime according to the actual operating environment, thereby effectively constraining the compliant use of APKs.

[0034] In a further embodiment, the environmental feature information includes at least one or more of the following: application identification information, application version information, terminal device model information, terminal device unique identification information, and project identification information.

[0035] Specifically, in practical applications, when collecting environmental characteristic information, the client verification module can characterize the current application's operating environment from multiple dimensions. This environmental characteristic information includes at least application identification information, such as the application's package name, version number, or internal version identifier, used to distinguish different application instances and their release versions. It may also include terminal device-related information, such as the terminal device's brand, model, and unique device identifier, to reflect the hardware environment in which the application is currently running.

[0036] Furthermore, in multi-project or multi-authorization scenarios, the client-side verification module can further collect project identification information. This project identification information can be obtained from system properties, configuration files, or application runtime parameters, and is used to distinguish the usage scenarios of the same source code in different authorized projects. By introducing project identification information, the cloud-based verification service can more accurately identify the actual authorization ownership of the application during subsequent policy matching.

[0037] It should be noted that the aforementioned environmental characteristic information does not necessarily need to be collected simultaneously. The client verification module can select one or more of these characteristics for collection based on specific implementation needs. By flexibly combining application information, device information, and project information, this implementation method can provide sufficient operating environment characteristics for cloud verification services without significantly increasing the burden on the client, for subsequent compliance judgments.

[0038] In a further embodiment, the environmental feature information is encrypted and accompanied by integrity verification information before being sent to the cloud verification service, in order to prevent the operating environment information from being tampered with during transmission.

[0039] After the client verification module completes the collection of environmental feature information, it can perform unified encapsulation processing on this information. Specifically, various types of environmental feature information can be organized according to a pre-agreed data structure, and corresponding data packets can be generated. After generating the data packets, the client verification module encrypts them to prevent the runtime environment information from being illegally stolen or tampered with during network transmission.

[0040] Meanwhile, to ensure data integrity, the client-side verification module can also attach integrity verification information to the encrypted data, such as by generating a verification code or signature information, for the cloud verification service to verify the data's legality after receiving it. Upon receiving the aforementioned environmental characteristic information, the cloud verification service can first verify the integrity verification information to confirm that the data has not been tampered with, and then parse the encrypted data and proceed to the policy matching process.

[0041] Through the aforementioned encryption and integrity verification processes, even if the application runs in an untrusted network environment, the collected environmental characteristic information can still be transmitted to the cloud verification service in a relatively secure manner, thereby ensuring that the verification control commands generated by the cloud based on the information have a reliable data foundation. This processing method further enhances the stability and security of the entire compliance verification process.

[0042] In a further embodiment, the policy rules include at least a whitelist policy for allowing the application to run normally, a blacklist policy for restricting the application from running, and a default policy for unknown operating environments.

[0043] In practical applications, the cloud-based verification service is pre-configured with a set of policy rules for determining the compliance of APK execution. These policy rules can be set according to different authorization modes, project types, or usage scenarios, and include at least one or more of whitelist policies, blacklist policies, and default policies. Specifically, the whitelist policy identifies application runtime environments that are allowed to run normally, such as runtime environments that meet specific project identifiers, terminal device models, or authorization conditions; the blacklist policy identifies explicitly restricted runtime environments, such as identified abnormal project identifiers or device environments that do not comply with authorization agreements; and the default policy handles runtime environments that do not explicitly match the whitelist or blacklist.

[0044] During the cloud-based verification process, after receiving the environmental feature information uploaded by the client, the cloud verification service sequentially or in parallel matches and analyzes the environmental feature information with various policy rules. When the runtime environment information meets the whitelist policy conditions, the cloud verification service can determine that the current application runtime environment is a compliant environment; when the runtime environment information matches the blacklist policy conditions, it can determine that the current runtime environment is a non-compliant environment; for cases where the above policies are not matched, the cloud verification service can handle the situation according to a preset default policy.

[0045] By introducing various types of policy rules, the cloud-based verification service can flexibly adjust compliance judgment logic under different authorized usage scenarios without updating or redeploying the client, thereby improving the adaptability and maintainability of the entire verification system in engineering practice.

[0046] In a further embodiment, the verification control instruction includes at least a control identifier for whether to trigger a user interaction prompt, the content of the prompt message, and control parameters for whether to terminate the application process.

[0047] After completing the policy rule matching analysis, the cloud-based verification service generates verification control instructions corresponding to the current operating environment based on the matching results. These verification control instructions include at least a control flag indicating whether to trigger user interaction prompts, used to instruct the client verification module whether to display prompt information to the user; they may also include the specific content of the prompt information, used to explain the current application operating status or compliance status to the user.

[0048] Furthermore, the verification control instruction may also include control parameters for whether to terminate the application process, used to instruct the client verification module whether to control the current application process state under specific conditions. For example, when it is determined that the current operating environment does not meet the authorization conditions, the verification control instruction may instruct the client to terminate the application process after completing the prompt interaction; while in scenarios where only risk prompts are required, the client may be instructed to only display the prompt information without terminating the application.

[0049] Upon receiving the verification control command, the client-side verification module parses the command content and executes corresponding control operations during application operation based on each control field. By distributing the verification results from the cloud in the form of structured commands, the client does not need to determine compliance itself; it only needs to execute the commands, thereby further reducing the complexity of client logic and ensuring consistency between operational control behavior and cloud policies.

[0050] In a further embodiment, when the verification control instruction indicates the termination of the application process, the client verification module, after completing user interaction or meeting preset conditions, calls the system-level process control interface to terminate the current application process.

[0051] In actual operation, when the client verification module receives a verification control command returned by the cloud verification service, and the verification control command contains control parameters for terminating the application process, the client verification module does not immediately force the application process to terminate. Instead, it performs corresponding control operations during the application's runtime phase according to a preset process. Specifically, the client verification module may first trigger a user interaction prompt process, such as displaying a prompt message on the application interface to inform the user that the current application runtime environment is abnormal or does not meet the authorization conditions.

[0052] After completing the user interaction prompts, the client verification module determines whether the process control conditions in the verification control command are met. When the termination conditions are met, the client verification module calls the system-level process control interface provided by the mobile operating system to terminate the current application process. This termination process directly acts at the application process level, preventing the application from continuing to run, thereby effectively blocking unauthorized execution.

[0053] Through the above methods, this implementation method achieves direct control over the application process state while ensuring the integrity of the user interaction flow. Compared to solutions that only impose restrictions or prompts at the interface level, this process-level control method can form more explicit and effective technical constraints during the application runtime phase, improving the actual control effect of APK compliance verification.

[0054] In a further embodiment, the policy rules and verification logic are centrally maintained and dynamically updated by the cloud verification service. The client verification module does not contain decision logic for judging compliance, but only performs corresponding operation control operations based on the verification control instructions returned by the cloud.

[0055] In this implementation, the policy rules and verification logic used to determine whether the APK runtime environment is compliant are all centrally deployed on the cloud verification service side, and are uniformly maintained and dynamically updated by the cloud. The client verification module does not contain decision logic for determining compliance; its function is limited to collecting and uploading runtime environment characteristic information, and parsing and executing verification control instructions returned by the cloud.

[0056] When authorization policies are adjusted, project configurations change, or new abnormal operating environments need to be addressed, the relevant verification logic only needs to be updated in the cloud verification service. This will take effect on all running application instances without modifying the client program or republishing the APK. Throughout the entire process, the client verification module consistently executes the corresponding runtime control operations according to the verification control instructions issued by the cloud, ensuring consistency between runtime control behavior and cloud policies.

[0057] By decoupling the verification logic and control policies from the client and centralizing them in the cloud, this implementation method creates an asymmetric operational compliance verification model in terms of technical architecture. This means the client is easy to integrate and has simplified logic, while the core judgment capabilities are controlled by the cloud. This model not only reduces the risk of the verification logic being decompiled or tampered with, but also ensures that even if the APK is copied or repackaged, its operational behavior remains constrained by cloud policies, thereby significantly improving the technical control over the compliant use of source code.

[0058] Another aspect of this invention provides an APK execution compliance verification system based on cloud-based policy control. Please refer to [link / reference]. Figure 6 ,include: Client verification module 1 is used to collect environmental characteristic information of the application's running environment and control the application's running status according to the verification control instructions returned by the cloud. The cloud-based verification service module 2 is used to receive the environmental feature information and generate the verification control instructions based on the policy rules.

[0059] This embodiment provides an APK runtime compliance verification system based on cloud-based policy control, used to verify and control the compliant use of APKs during application runtime. The system mainly includes a client verification module 1 and a cloud verification service module 2, which interact and cooperate via network communication.

[0060] The client-side verification module 1 is deployed on the mobile terminal and embedded into the target application in a component-based manner. The client-side verification module 1 collects environmental characteristic information representing the application's operating environment during application runtime and performs corresponding control operations on the application's running status based on the verification control instructions returned by the cloud-based verification service module 2. The client-side verification module 1 can be triggered during application startup or runtime, and its implementation is independent of specific business logic, thus facilitating reuse in different applications or projects.

[0061] In its implementation, the client-side verification module 1 may include an environment information acquisition unit and an instruction execution unit. The environment information acquisition unit obtains runtime environment-related information from the application itself and the terminal device, such as application identification information, terminal device information, or project identification information, and then organizes and sends the collected information to the cloud verification service module 2. The instruction execution unit receives verification control instructions returned from the cloud, parses the instruction content, and executes corresponding runtime control operations during application operation based on the parsing results, such as controlling the application display process or processing the application's runtime status.

[0062] The cloud-based verification service module 2 is deployed on the server side and processes the environmental feature information from the client verification module 1, generating verification control instructions based on preset policy rules. The cloud-based verification service module 2 can centrally maintain policy rules for judging application compliance and configure these rules according to different authorized projects, operating environments, or management needs. After receiving the environmental feature information uploaded by the client, the cloud-based verification service module 2 parses the information, performs matching analysis according to the policy rules, generates verification control instructions corresponding to the current operating environment, and returns the verification control instructions to the client verification module 1.

[0063] Through the collaborative work of the client-side verification module 1 and the cloud-based verification service module 2, this implementation method achieves system-level verification of APK runtime compliance. The client side is responsible for collecting environmental information and executing runtime control, while the cloud side is responsible for compliance determination and policy control. This allows the system to maintain a lightweight client while enabling unified management and effective constraints on application runtime behavior through cloud policies.

[0064] In a further embodiment, the cloud verification service module 2 includes a policy management unit for configuring, updating, or distributing policy rules.

[0065] In this embodiment, the cloud verification service module 2 further includes a policy management unit for configuring, maintaining, and updating policy rules used for APK execution compliance verification. The policy management unit can be implemented as an independent functional unit within the cloud verification service module 2, or it can work collaboratively with other functional units of the cloud verification service module 2.

[0066] The policy management unit stores and manages multiple sets of policy rules, which can be categorized and configured according to different authorized items, application identifiers, or terminal device types. Through the policy management unit, administrators can adjust policy rules based on actual authorization conditions, such as adding allowed operating environment conditions, adjusting policy parameters that restrict operation, or modifying the default handling method for unknown operating environments. All of the above policy configuration operations are completed in the cloud, without requiring modification or redeployment of the client verification module 1.

[0067] During system operation, after receiving the environmental feature information uploaded by the client verification module 1, the cloud verification service module 2 invokes the configured policy rules in the policy management unit to perform matching analysis on the environmental feature information. Based on the matching results, the policy management unit outputs the corresponding policy judgment result to the cloud verification service module 2, which then generates verification control instructions. By separating the management of policy rules from the verification processing, the maintenance of policy rules becomes clearer, and subsequent policy expansion and adjustment are facilitated.

[0068] Furthermore, the policy management unit supports dynamic updates to policy rules. When policy rules change, the updated policy rules take effect immediately and are applied to subsequent verification requests initiated by clients, enabling the system to continuously adapt to changes in different authorization scenarios and operating environments without affecting client operation.

[0069] By introducing a policy management unit, this implementation method further enhances the flexibility and maintainability of the system for APK runtime compliance verification, enabling the cloud verification service to achieve fine-grained control over different runtime scenarios under a unified architecture.

[0070] In another aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is used to implement the method described above.

[0071] Specifically, the computer-readable storage medium may include, but is not limited to, read-only memory, read-write memory, flash memory, or other storage media capable of storing program code. The computer program is loaded and runs on the processor of the mobile terminal or server device to drive relevant functional modules to execute corresponding program instructions.

[0072] When the computer program is executed on the mobile terminal side, it can be used to collect and encapsulate application runtime environment characteristic information and send it to the cloud verification service, and control the application's running state after receiving the verification control command returned from the cloud; when the computer program is executed on the server side, it can be used to receive environment characteristic information, perform matching analysis based on policy rules, and generate verification control commands.

[0073] By storing the program that implements the above method steps in a computer-readable storage medium, this embodiment enables the APK execution compliance verification method based on cloud policy control to be deployed and implemented in the form of a software product, thereby further enhancing the feasibility and versatility of the technical solution in different application scenarios.

[0074] In summary, this invention constructs a cloud-based policy-controlled APK runtime compliance verification technology solution by introducing a client-side verification module 1 into the application and deploying a configurable verification service and policy management mechanism in the cloud. In this solution, the client side is mainly responsible for collecting runtime environment characteristic information and executing cloud verification control commands, while the cloud side is responsible for the centralized maintenance of compliance judgment logic and policy rules, thereby achieving effective separation of verification logic and application ontology at the system architecture level.

[0075] Through the aforementioned technical arrangements, this invention can dynamically generate corresponding verification control instructions based on different operating environments, project identifiers, or authorization policies during the application runtime phase, and control the application's display flow or process status, avoiding the problem of verification mechanisms being easily bypassed in traditional static protection schemes. Furthermore, since the core judgment logic is not distributed with the APK, even if the application is copied, repackaged, or run in an unexpected environment, its behavior is still constrained by cloud policies, thereby improving the overall control over the compliant use of source code.

[0076] Furthermore, this invention maintains the lightweight nature of the client-side implementation in its engineering implementation, does not rely on complex local decision-making logic, and does not affect the normal operation of the original application functions. The cloud strategy can be flexibly adjusted and continuously updated according to the actual authorization situation, exhibiting good scalability and maintainability. Therefore, the technical solution provided by this invention can adapt to real-world application scenarios involving multiple projects and multiple terminals, possessing high engineering practical value.

[0077] It should be understood that the application of the present invention is not limited to the examples above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A method for APK execution compliance verification based on cloud-based policy control, characterized in that, Includes the following steps: S1. During the application startup phase running on the mobile terminal, the client verification module embedded in the application collects environmental feature information that characterizes the current application running environment. S2. The environmental feature information is encrypted and encapsulated before being sent to the cloud verification service; S3. The cloud-based verification service performs matching and analysis on the environmental feature information based on pre-configured policy rules, and generates verification control instructions corresponding to the current operating environment. S4. The client verification module receives the verification control instruction and controls the display flow or process status of the application during application operation according to the verification control instruction, so as to realize runtime verification of APK compliance.

2. The APK execution compliance verification method according to claim 1, characterized in that, The environmental characteristic information includes at least one or more of the following: application identification information, application version information, terminal device model information, terminal device unique identification information, and project identification information.

3. The APK execution compliance verification method according to claim 1, characterized in that, Before being sent to the cloud verification service, the environmental feature information is encrypted and accompanied by integrity verification information to prevent the operating environment information from being tampered with during transmission.

4. The APK execution compliance verification method according to claim 1, characterized in that, The policy rules include at least a whitelist policy for allowing the application to run normally, a blacklist policy for restricting the application from running, and a default policy for unknown operating environments.

5. The APK execution compliance verification method according to claim 1, characterized in that, The verification control command includes at least a control identifier for whether to trigger user interaction prompts, the content of the prompt information, and control parameters for whether to terminate the application process.

6. The APK execution compliance verification method according to claim 1, characterized in that, When the verification control instruction indicates to terminate the application process, the client verification module, after completing user interaction or meeting preset conditions, calls the system-level process control interface to terminate the current application process.

7. The APK execution compliance verification method according to claim 1, characterized in that, The policy rules and verification logic are centrally maintained and dynamically updated by the cloud verification service. The client verification module does not contain decision logic for judging compliance; it only executes the corresponding operation control operation based on the verification control instructions returned by the cloud.

8. An APK execution compliance verification system based on cloud-based policy control, characterized in that, include: The client-side verification module is used to collect environmental characteristic information of the application's operating environment and control the application's running status based on the verification control instructions returned from the cloud. The cloud-based verification service module is used to receive the environmental feature information and generate the verification control instructions based on policy rules.

9. The APK execution compliance verification system according to claim 8, characterized in that, The cloud-based verification service module includes a policy management unit, which is used to configure, update, or distribute policy rules.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program is used to implement the method as described in any one of claims 1 to 7.

Images